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The MAILING DATE of this communication appears on the cover sheet with the correspondence address « 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 

WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication, 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment See 37 CFR 1 .704(b). 

Status 

1 )[X] Responsive to communication(s) filed on 12 July 2007 . 
2a)Kl This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle } 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1,4,8-16 and 20-23 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) IEI Claim(s) 1,4,8-16 and 20-23 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) Q Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) Q The specification is objected to by the Examiner. 

10) Q The drawing(s) filed on is/are: a)D accepted or b)Q objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) Q Acknowledgment is made of a claim for foreign priority under 35 U.S.C, § 119(a)-(d) or (f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2.Q Certified copies of the priority documents have been received in Application No. . 

3.0 Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1. Claims 1, 4, 8-16, and 20-23 are pending. 

2. Amendment filed 07/12/2007 has been received and 
considered . 

Claim Rejections - 35 VSC §101 

3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, 
manufacture, or composition of matter, or any new and useful improvement 
thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

4. Claims 12-16 and 20 are rejected under 35 U.S.C. 101 
because the claimed invention is directed to non-statutory 
subject matter. Claims 12 and 13 relate to a computer data 
signal, which fails to fall within one of the categories of 
patentable subject matter. Similarly, claims 14-16 and 20 
relate to an apparatus with components, in these claims there is 
not explicit hardware and these components may merely be 
software (see paragraph. 30 of the specification. Therefore, 
these claims lack the necessary physical articles or objects to 
constitute a machine or a manufacture within the mean of 35 USC 
101. They are clearly not a series of steps or acts to be a 
process not are they a combination of chemical compounds to be a 
composition of matter. As such, they fail to fall within a 
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statutory category. They are, at best, functional descriptive 
material per se. 

Claim Rejections - 35 USC §103 

5. The following is a quotation of 35 U.S.C. 103(a) which 
forms the basis for all obviousness rejections set forth in this 
Office action: 

(a) A patent may not be obtained though the invention is not 
identically disclosed or described as set forth in section 102 of this 
title, if the differences between the subject matter sought to be 
patented and the prior art are such that the subject matter as a whole 
would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the 
invention was made. 

6. Claims 1, 4, 10-16, 21 and 22 are rejected under 35 U.S.C. 
103(a) as being unpatentable over Chess (US 6192512) in view of 
Chambers (US 5398196) . 

As per claims 1, 10, 11, 12, and 14, Chess discloses a 
method of detecting viral code in subject files, comprising: 
creating an artificial memory region spanning one or more 
components of the operating system (see Fig. 2 column 4 lines 
49-51); emulating execution of at least a portion of computer 
executable code in a subject file (see column 4 lines 33-49); 
detecting an attempt by the emulated computer executable code to 
access the artificial memory region; and determining based on 
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the attempt to access the artificial memory region that the 
emulated computer executable code is viral (see column 4 lines 
4 9-54) . 

Chess fails to explicitly disclose monitoring operating 
system calls by the emulated computer executable code to detect 
an attempt to access the artificial memory region. 

However, Chambers teaches such monitoring (see column 6 
line 60 through column 7 line 15). 

At . the time of the invention it would have been obvious to 
a person of ordinary skill in the art to monitor the operating 
system calls of the Chess system. 

Motivation to do so would have been to detect viral 
activity and report the status of all operating system requests 
performed by the program (see Chambers column 7 lines 55-60) . 

As per claims 4 and 16, the modified Chess and Chambers 
system discloses emulating functionality of the identified 
operating system call while monitoring the operating system call 
to determine whether the computer executable code is viral (see 
Chess column 4 lines 33-54). 

As per claims 13 and 15, the modified Chess and Chambers 
system discloses a fourth segment comprising auxiliary code, 
wherein the auxiliary code determines an operating system call 
that the emulated computer executable code attempted to access; 
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a fifth segment comprising analyzer code, wherein the analyzer 
code monitors the operating system call to determine whether the 
computer executable code is viral, while emulation continues 
(see Chess column 4 lines 33-54) . 

As per claim 21, the modified Chess and Chambers system 
discloses monitoring accesses by the emulated computer 
executable code to the artificial memory region to detect 
looping; and determining based on the detection of looping that 
the emulated computer executable code is viral (see Chambers 
column 10 lines 40-58) . 

As per claim 22, the modified Chess and Chambers system 
discloses creating an artificial memory region comprises 
creating a custom version of an export table with predetermined 
values for the entry points (see Chambers column 9 lines 14-54). 
7. Claims 8, 9, 20 and 23 are rejected under 35 U.S.C. 103(a) 
as being unpatentable over the modified Chess and Chambers 
system as applied to claims 1 and 14 above, in view of Golan (US 
5974549) . 

As per claims 8 and 23, the modified Chess and Chambers 
system fails to disclose monitoring access by the emulated 
computer executable code to dynamically linked functions. 

However, Golan teaches monitoring access by the emulated 
computer executable code to dynamically linked functions (Col 6, 



Application/Control Number: 09/905,532 Page 6 

Art Unit: 2137 

lines 6-12; Col 5, lines 60-63) ; and Golan describes a security 
monitor method whereby access to dynamically linked functions is 
regulated because, as Golan discloses, M in an operating system 
that supports virtual memory and hardware abstraction, a 
software component can only breach security by calling a system 
call" (Col 5, lines 38-41) . 

It would have been obvious to one of ordinary skill in that 
art at the time the invention was filed to have combined the 
teachings of the modified Chess and Chambers system with those 
of Golan and monitor access to dynamically linked functions 
because requesting access to dynamically linked functions could 
be an attempt to breach security. 

As per claim 9, the applicant discloses the method of claim 
8, which is met by the modified Chess and Chambers system in 
view of Golan (see above), with the following limitation which 
is met by Golan: 

Wherein the artificial memory region spans a jump table 
containing pointers to the dynamically linked functions (Col 7, 
lines 31-35) . 

Chess in view of Golan describes all the limitations of 
claim 8. Golan describes the additional limitation of a jump 
table containing pointers to the dynamically linked functions. 
The jump table is often incorporated with dynamically linked 
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functions to store the actual addresses of the dynamically 
linked functions. It would have been obvious to one of ordinary 
skill in the art at the time in the invention was filed to have 
included a jump table with the method so that there could be a 
way of storing the actual addresses of the dynamically linked 
functions . 

As per claim 20, the applicant discloses the method of 
claim 14, which is met by the modified Chess and Chambers system 
(see above), with the following limitation which is met by 
Golan : 

Wherein the artificial memory region created by the memory 
manager component spans a jump table containing pointers to 
dynamically linked functions, and the monitor component monitors 
access by the emulated computer executable code to the 
dynamically linked functions. 

The claim is met by the combination of claims 8 and 9. 
Explanations for claim 8 and 9 rejections are listed above. 

Response to Arguments 

8. Applicant's arguments with respect to the art applied to 
claims 1, 4, 8-16, and 20-23 have been considered but are moot 
in view of the new ground(s) of rejection. 
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9. Applicant's arguments filed 07/12/2007 have been fully 
considered but they are not persuasive. Applicant argues the 
rejection of claims 12-16 and 20 as being non-statutory under 35 
USC 101 is improper. 

With respect to Applicant's argument claims 12 and 13 are 
related to a data signal embodied in a transmission medium. 
Applicant's specification states that this medium can be such 
things as the Internet, an intranet, or any other wired or 
wireless transmission medium. Therefore, these claims merely 
relate to the signals traveling over a network. These signals 
are clearly not tangible and are therefore non-statutory. 
Furthermore a signal claim fails to fall within one of the 
statutory classes. Applicant attempts to overcome this fact by 
citing a passage from the November 22, 2005 Official Gazette 
Notice. However, the paragraph following the one cited by 
applicant states, "These interim guidelines propose that such 
signal claims are ineligible for patent protection because they 
do not fall within any of the four statutory classes of Sec. 
101." Therefore, claims 12 and 13 are non-statutory. It is 
recommended that instructions be embodied on the computer 
readable media (e.g. memory) described on page 8 in lines 21-23 
of the specification. 
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Applicant further argues that claims 14-16 and 20 are 
statutory because the fact that the claimed elements may be 
software does not render the claimed subject matter non- 
statutory. However, referring to page 8 lines 21-28 pf the 
specification the apparatus is merely software because there is 
no hardware tired to the emulator or components of these claims 
and therefore fails to fall with any of the statutory classes. 
It is recommended that the apparatus claims include some sort of 
physical hardware described with respect to the device/system 
shown in figure 1 in order for the claims to constitute a 
machine . 

Conclusion 

10. Applicant's amendment necessitated the new ground (s) of 
rejection presented in this Office action. Accordingly, THIS 
ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is 
reminded of the extension of time policy as set forth in 37 
CFR 1 . 136(a) . 

A shortened statutory period for reply to this final action 
is set to expire THREE MONTHS from the mailing date of this 
action. In the event a first reply is filed within TWO MONTHS 
of the mailing date of this final action and the advisory action 
is not mailed until after the end of the THREE-MONTH shortened 
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statutory period, then the shortened statutory period will 
expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated 
from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than 
SIX MONTHS from the date of this final action. 

11. The prior art made of record and not relied upon is 
considered pertinent to applicant's disclosure. Chen teaches 
monitoring dynamically linked functions to determine viral 
activity . 

Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to Michael 
Pyzocha whose telephone number is (571) 272-3875. The examiner 
can normally be reached on 7:00am - 4:30pm first Fridays of the 
bi-week off. 

If attempts to reach the examiner by telephone are 
unsuccessful, the examiner's supervisor, Emmanuel Moise can be 
reached on (571) 272-3865. The fax phone number for the 
organization where this application or proceeding is assigned is 
571-273-8300 . 
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Information regarding the status of an application may be 
obtained from the Patent Application Information Retrieval 
(PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free) . If you would 
like assistance from a US'PTO Customer Service Representative or 
access to the automated information system, call 800-786-9199 
(IN USA OR CANADA) or 571-272-1000. 
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